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ABSTRACT. Cyclic codes are a subclass of linear codes and have applications in con- 
sumer electronics, data storage systems, and communication systems as they have efficient 
encoding and decoding algorithms. In this paper, almost perfect nonlinear functions and 
planar functions over finite fields are employed to construct a number of classes of cyclic 
codes. Lower bounds on the minimum weight of some classes of the cyclic codes are de- 
veloped. The minimum weights of some other classes of the codes constructed in this paper 
are determined. The dimensions of the codes are flexible. Many of the codes presented in 
this paper are optimal or almost optimal in the sense that they meet some bound on linear 
codes. Ten open problems regarding cyclic codes from highly nonlinear functions are also 
presented. 



1. Introduction 

Let q be a power of a prime p. A linear [n,k,d] code over GF(^) is a A:-dimensional sub- 
space of GF(q)" with minimum (Hamming) nonzero weight d. A linear [n,k] code C over 
the finite field GF[q) is called cyclic if (cq,c\, ■ ■ ■ ,c„_i) G (^implies (c„-i,cq,ci,- ■ ■ ,c n -2) G 
C- Let gcd(n,^) = 1. By identifying any vector (cq,ci,- ■ • ,e„_i) G GF(q)" with 

c + cix + c 2 x 2 H h c„- rx"~ 1 G GF(q) [x] /(*" - 1), 

any code C of length n over GF{q) corresponds to a subset of GF(q)[x]/ (x" — 1). The 
linear code C is cyclic if and only if the corresponding subset in GF(q)[x]/ (x" — 1) is an 
ideal of the ring GF(q) [x] / (x n — 1 ) . It is well known that every ideal of GF(q) [x] / (x n — 1 ) 
is principal. Let C = (g(x)) be a cyclic code. Then g(x) is called the generator polynomial 
and/i(x) = (x" — \)/g(x) is referred to as the parity-check polynomial of C- 

A vector (co,ci, ■ • • ,c„_i) G GF(g)" is said to be even-like if L"=o c i = 0, and is odd- 
like otherwise. The minimum weight of the even-like codewords, respectively the odd-like 
codewords of a code is the minimum even-like weight, denoted by d even , respectively the 
minimum odd-like weight of the code, denoted by d dd- The even-like subcode of a linear 
code consists of all the even-like codewords of this linear code. 

The error correcting capability of cyclic codes may not be as good as some other linear 
codes in general. However, cyclic codes have wide applications in storage and communi- 
cation systems because they have efficient encoding and decoding algorithms lfl3l l20l l29l . 
For example, Reed-Solomon codes have found important applications from deep-space 
communication to consumer electronics. They are prominently used in consumer electron- 
ics such as CDs, DVDs, Blu-ray Discs, in data transmission technologies such as DSL & 
WiMAX, in broadcast systems such as DVB and ATSC, and in computer applications such 
as RAID 6 systems. 
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Cyclic codes have been studied for decades and a lot of progress has been made (see 
for example, (5] [T2] |25] |27)). The total number of cyclic codes over GF(^) and their 
constructions are closely related to cyclotomic cosets modulo n, and thus many areas of 
number theory. One way of constructing cyclic codes over GF(q) with length « is to use 
the generator polynomial 



and s°° = (s;)°lo ^ s a se 1 uence of period n over GF(q). Throughout this paper, we call the 
cyclic code C s with the generator polynomial of (Q~|i the code defined by the sequence s°°, 
and the sequence s°° the defining sequence of the cyclic code C s - 

One basic question is whether good cyclic codes can be constructed with this approach. 
It will be demonstrated in this paper that the code C s could be an optimal or almost optimal 
linear code if the sequence s°° is properly designed. 

In this paper, almost perfect nonlinear ( APN) functions and planar functions over GF(q m ) 
will be employed to construct a number of classes of both binary and nonbinary cyclic 
codes. Lower bounds on the minimum weight of some classes of the cyclic codes are 
developed. The minimum weights of some other classes of the codes constructed in this 
paper are determined. The dimensions of the codes of this paper are flexible. Some of the 
codes obtained in this paper are optimal or almost optimal as they meet certain bounds on 
linear codes. Ten open problems regarding cyclic codes from highly nonlinear functions 
are also presented in this paper. 

Our first motivation of this study is that the codes constructed in this paper are often 
optimal. Our second motivation is the simplicity of the constructions of the cyclic codes 
that may lead to efficient encoding and decoding algorithms. 



In this section, we present basic notations and results of almost perfect nonlinear and 
planar functions, ^-cyclotomic cosets, and sequences that will be employed in subsequent 
sections. 

2.1. Some notations fixed throughout this paper. Throughout this paper, we adopt the 
following notations unless otherwise stated: 

• p is a prime. 

• q is a positive power of p. 

• m is a positive integer. 

• r = q . 

• n = q m -l. 

• Z„ = {0, 1,2, ■ ■ ■ ,n — 1} associated with the integer addition modulo n and integer 
multiplication modulo n operations. 

• a is a generator of GF(r)*. 

• m a (x) is the minimal polynomial of a G GF(r) over GF(g). 

• Np(x) is a function defined by N p (i) = Oif i = (mod p) and N p (i) = 1 otherwise, 
where ; is any nonnegative integer. 

• Tr(jc) is the trace function from GF(r) to GF(g). 



(1) 



gcd(S(x),Jc" - 1) 



where 



n-l 




2. Preliminaries 
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2.2. The g-cyclotomic cosets modulo q'" — 1. The g-cyclotomic coset containing j mod- 
ulo n is defined by 

(\i \j-<ij-<fj---- -<l" './'} ' 

where it is the smallest positive integer such that q (j ~ l j = j (mod n), and is called the 
size of Cj. It is known that tj divides n. The smallest integer in Cj is called the coset leader 
of Cj. Let r denote the set of all coset leaders. By definition, we have 

\Jq = z n . 

2.3. The linear span and minimal polynomial of sequences. Let s L = sqsi ■ sl-i be a 
sequence over GF(q). The linear span (also called linear complexity) of s L is defined to 
be the smallest positive integer I such that there are constants cq = \,c\,--- ,cg € GF(q) 
satisfying 

— cos,- = cis;_i + C25,_2 H h ciSi-t for all i <i < L. 

In engineering terms, such a polynomial c{x) = cq + c\x H h c/x' is called the feedback 

polynomial of a shortest linear feedback shift register (LFSR) that generates s L . Such an 
integer always exists for finite sequences s L . When L is °o, a sequence s°° is called a semi- 
infinite sequence. If there is no such an integer for a semi-infinite sequence s°°, its linear 
span is defined to be °°. The linear span of the zero sequence is defined to be zero. For 
ultimately periodic semi-infinite sequences such an I always exists. 

Let i°° be a sequence of period L over G¥(q) . Any feedback polynomial of s°° is called a 
characteristic polynomial. The characteristic polynomial with the smallest degree is called 
the minimal polynomial of the periodic sequence s°° . Since we require that the constant 
term of any characteristic polynomial be 1, the minimal polynomial of any periodic se- 
quence s°° must be unique. In addition, any characteristic polynomial must be a multiple 
of the minimal polynomial. 

For periodic sequences, there are a few ways to determine their linear span and minimal 
polynomials. One of them is given in the following lemma lf26l . 

Lemma 2.1. Let 5°° be a sequence of period L overGF(q). Define 

S L (x) =s + six-\ hsux^ 1 eGF(q)[x]. 

Then the minimal polynomial M s (x) of s°° is given by 

(2) X —l 

gcd{x L -l,S L (x)) 

and the linear span L s of s°° is given by 

(3) L-deg(gcd(x L -l,S L M)). 

The other one is given in the following lemma 0") 

Lemma 2.2. Any sequence s°° over GF(g) of period q m — 1 has a unique expansion of the 
form 

q m -2 

S t = c i' a " ' i f or a M 1 > 0; 

(=0 

where a is a generator ofG¥{q m )* and c; G GF(g m ). Let the index set I = {i a ^ 0}, then 
the minimal polynomial M iS (x) of s°° is 

M s {x)=Y\(l-a i x), 

iei 
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and the linear span of s°° is \I\. 

It should be noticed that in some references the reciprocal of M s (x) is called the minimal 
polynomial of the sequence s°°. So Lemma |2~2l is a modified version of the original one in 

ID. 

2.4. Perfect and almost perfect nonlinear functions on GF(r). A function / : GF(r) — y 
GF(Y) is called almost perfect nonlinear (APN) if 

max max \{x € GF(r) : f(x + a) — f(x) = b}\ = 2. 

aGGF(r)* b€GF(r) 

and is referred to as perfect nonlinear or planar if 

max max I {x <E GF(r) : fix + a) - f(x) = b}\ = \. 

a£GF{r)* beGF(r) 

There is no perfect nonlinear (planar) function on GF(2 m ). The following is a summary 
of known APN monomials x e over GF(2'"): 

• e = 2 m -2,m odd (Il2ll28l). 

• e = 2 h + 1 with gcd(/j,m) = 1, where 1 < h < (m — l)/2 if m is odd and 1 < h < 
(m — 2)/2 if m is even ( I12TI ). 

• e = 2 2h — 2 h + 1 with gcd(h,m) = 1, where 1 < h < (m — l)/2 if m is odd and 
1 < h < [m - 2) /2 if m is even (l23l). 

• e = 2('"- 1 V 2 + 3, where m is odd ( lfljll24l ). 

• e = 2(" , - 1 V 2 + 2(" 1 - 1 )/ 4 - 1, where m = 1 (mod 4) (Ell El). 

• e = 2('"- 1) / 2 + 2( 3m - 1 )/ 4 -l,wheremEE3 (mod 4) ( QUED) . 

• e = 2 4i + 2 3i + 2 2i + 2 l - 1, where m = 5i ({T9\). 

A number of other types of APN functions f(x) on GF(2'") were discovered in El |6j EJ [8] . 
The following is a summary of known APN monomials x e over G¥{p) m where p is odd: 

• e = 3, p > 3 (ED). 

: p m - 2, p > 2 and p = 2 (mod 3) (ifTTl). 



= p = 3,7 (mod 20), p m > 7, p m ^ 27 and m is odd (El). 
= £+1 + pln s 3 (mod g) (JlT)). 

_ ,y»+i 



• e = p m — 3, p = 3 and ?7i is odd. 

• e = p l + 2, p l = 1 (mod 3) and m = 21 (IfTTl). 

• e = ^y^-, p = 5 and gcd(2m,/i) = 1. 



-^i, p m = 7 (mod 8) (El). 
2j ^,p m =2 (mod 3) (H71). 



3(m+i)/4_ 1 ^j ^3(™+i)/2 + 1 ^ m = 3 (mod4)andp = 3E3l. 



• Let p = 3, and 



• Let p = 3, and 



3 (m+l)/2_ 1 
2 

3 (m+l)/2_j 



3 m+ — 1 
8 

om+ 1 _ j 



k 8 

-1 5('"+l)/2_! 



if m = 3 (mod 4) 
if m = 1 (mod 4). 

if m = 3 (mod 4) 
if = 1 (mod 4). 



- c — —q— i j ' P — 5 an d w is °dd ||33]. 

The following is a list of some known palnar functions over p m , p odd: 
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• m=x 2 . 

• f(x) =x p + 1 , where mj gcd(m,ti) is odd ( |fT31 ). 

• f(x) =x^ l '+ l '>/ 2 , where p = 3 and gcd(m,h) = 1 (HI). 

• f (x) = x 10 - ux 6 - u 2 x 2 , where p = 3,uG GF{p m ), m is odd ( fl4l[l6l ). 

Recently, more planar functions were discovered in 11311 132] 1331 . 

In the sequel, some of the APN functions and all the planar functions on G¥(q m ) above 
will be employed to construct cyclic codes over G¥(q). 

2.5. Codes defined by highly nonlinear functions. Given any function f(x) on GF(r), 
we define its associated sequence s°° by 

(4) Si=Ti{f[pt + \)) 

for all i > 0, where a is a generator of GF(r)* and Tr(x) denotes the trace function from 
GF(r) to GF(q). 

The objective of this paper is to consider the codes C s defined by planar functions and 
APN functions over G¥(q m ). We need to treat the cases q — 2 and q being odd separately as 
planar functions on GF(2 m ) do not exist, while both APN and planar functions on GF(q m ) 
exist when q is odd. 

Highly nonlinear (i.e., almost perfect nonlinear, perfect nonlinear and bent) functions 
were employed to construct linear codes with good parameters in l9l [T0l[TTI . The approach 
to the constructions of cyclic codes with APN and planar functions employed in this paper 
is quite different. 

3. Binary cyclic codes from APN functions on GF(2 m ) 

Planar functions on GF(2" ? ) do not exist. In this section, we treat binary cyclic codes 
derived from APN functions on GF(2 m ), and fix q to be 2 throughout this section. 

3.1. Binary cyclic codes from the inverse APN function. In this subsection we study 
the code C s defined by the inverse APN function on GF(2 m ). To this end, we need to prove 
the following lemma. 

Let p, denote the total number of even integers in the 2-cyclotomic coset C\. We then 
define 

(5) V; = ^p- mod 2 
for each i G Y, where £, = \Q\. 

Lemma 3.1. Let s°° be the sequence o/fO, where f(x) = x 2 "'~ 2 . Then the linear span Lj 
ofs°° is equal to (n + 1) /2 and the minimal polynomial M. s (x) ofs°° is given by 

(6) M.(*)= EI m a-/W 

yer,vy=i 

where m a j (x) is the minimal polynomial of a J over GF(2). 

Proof. The linear span of this sequence was already determined in ll30l . Below we prove 
only the conclusion on the minimal polynomial of this sequence. 



(1 
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It was proved in ll30l that 



(7) = EI« ;f2 " 

;er «=o 
where 




(8) fj,i 

It then follows from ©, (O and (]} that 



1 if (jl'"-' modn) mod2 = 
otherwise. 



(9) ^ = E v . E («')'' ■ 

The desired conclusion on the minimal polynomial M. s (x) then follows from Lemma [2721 
and ©. □ 

The following theorem provides information on the code C s and its dual. 

Theorem 3.2. The binary code C s defined by the sequence of Lemma \3. 1 1 has parameters 
[2 m — \,2 m — l,d] and generator polynomial M. v (x) o/©. 

Ifm is odd, the minimum distance d of Cs is at least d\, where d\ is the smallest positive 
even integer with d\ — d\ + 1 > n, and the dual code has parameters [2™ — 1 , 2 m ~ 1 , d^] 
where d 1 - satisfies that {d^) 2 — d^ + 1 > «. 

Proof. The dimensions of C s and its dual follow from Lemma 13.11 and the definitions of 
the codes C s and ■ 

If m is odd, by Lemma [XTl m\(x) = x — 1 is a divisor of the generator polynomial 
M s (x) of C s - Hence, all the codewords in C s have even Hamming weights, i.e., C s is an 
even-weight code. By definition, we have 

(10) p, + p„_, = l (mod 2) 

for every i £ {1,2, 1}. Note that m is odd. It then follows from (ITOb that 

V, +V„-, = l (mod 2) 

for every i £ {1,2, • • • ,n— 1}. Hence, one and only one of m a i (x) and m a -i (x) is a divisor of 
M s (jc) / (x — 1 ) for every i £ { 1 , 2 , ■ ■ ■ , n — 1 } . Let Q denote the cyclic code with generator 
polynomial M. s (x)/(x— 1). Then Q contains C s as its even-weight subcode. Using a 
similar approach to the proof of the square-root bound on the minimum weight for the 
quadratic residue codes, one proves the desired conclusions on the minimum weights of Cs 
and C S L . □ 

Example 3.3. Let m = 3 and a be a generator of GF(2 m )* with a 3 + a+ 1 = 0. In this 
case, the three 2-cyclotomic cosets are 

Co = {0},Ci = {1,2,4}, C 3 = {3,6,5}. 

The generator polynomial of the code C s is 

M s (x) = m a o {x)m a - 3 (x) = (x + 1) (x 3 + x + 1 ) = x 4 + x 3 + x 2 + 1 

and C s is a [7,3,4] binary cyclic code. Its dual is a [7,4,3] cyclic code. Both codes are 
optimal. 
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Example 3.4. Let m = 5 and a be a generator of GF(2 m )* with a 5 + a 2 + 1 = 0. Then the 
generator polynomial of the code Cs is 

M s (x) = m a o(x)m a -3(x)m a s(x)m a -i5(x) 

= (x+l)(x 5 +x 3 +x 2 +x+l) x 

(x 5 +x 4 +x 3 +x+l)(x 5 +x 2 + l) 

= x l6 +x u +x l3 +x l0 +x 9 +x 8 + 

x 1 +x 6 +x 5 +x 2 +x+l. 

and C s is a [31, 15,8] binary cyclic code. Its dual is an [31, 16,7] cyclic code. Both codes 
are optimal. 

When m is odd, the code C s has the square-root bound, although n could be a composite 
number. In addition, the examples above show that the actual minimum weight could be 
much larger than the lower bound on the minimum weight. 

When m is even, x~ l is not APN. In this case, the code C s may not have a good minimum 
distance. For example, if m — 4, the code C s has parameters [15,7,3]. So we are not 
interested in the case that m is even. 

3.2. Binary cyclic codes from the Gold APN function. In this subsection we study the 
code C s defined by the Gold APN function. To this end, we need to prove the following 
lemma. 

Lemma 3.5. Let m be odd. Let s°° be the sequence o/@, where fix) = x 2 +1 , gcd(/z, m) — 
1. Then the linear span L, s ofs°° is equal to m + 1 and the minimal polynomial Ml s {x) ofs°° 
is given by 

(11) M s (x) = {x-l)m a _ (2h+1) (x) 

where m a _^ 2 h +lj (x) is the minimal polynomial of ar^ 2 '' + ^ over GF(2). 
Proof. It is easily seen that 

(12) s t = 1 +Tr(a'( 2 " +1 )) = 1 + (a'f + ^ 2J . 

7=0 

By assumption, gcd(/z,ra) = 1. We have then gcd(2 /! — 1,2'" — 1) = 1. It then follows 
that 

gcd(2 A + 1 , 2'" - 1 ) = gcd(2 2A - 1 , 2'" - 1 ) = 2S cd ( 2/, - m) -1 = 1. 
Therefore, the size of the 2-cyclotomic coset contating 2 h + 1 is m. The desired conclusions 
on the linear span and the minimal polynomial M s (x) then follow from Lemma |2~2l and 
(H2]i. □ 

The following theorem provides information on the code C s - 

Theorem 3.6. Let m be odd. The binary code C s defined by the sequence of Lemma \3 .5\ has 
parameters [2 m — 1 , 2™ — 2 — m, d] and generator polynomial M. s (x) of ( 1771 ), where d > 4. 

Proof. The dimension of Cs follows from Lemma [331 and the definition of the code Cs- 
We need to prove the conclusion on the minimum distance d of C s . To this end, let C s 
denote the cyclic code with generator polynomial m^_^i, +l) (x). Then C s is the even-weight 

subcode of Cs- Since m^_^i, +l) (x) is a primitive polynomial with order 2"' — 1, it does not 
divide 1 +x 7 for any j with 2 < j < n — 1. This means that the minimum weight d of Cs is 
at least 3. Since d is even, we have then d > 4. □ 
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Example 3.7. Let (m,h) = (3,1) and a be a generator of GF(2 m )* with a 3 + a+ 1 = 0. 
Then Cs is a [7,3,4] binary code with generator polynomial 

M s (x) = x 4 +x 3 +x 2 + l. 

Its dual is a [7,4,3] cyclic code. Both codes are optimal. 

Example 3.8. Let (m,h) = (5,1) and a be a generator o/GF(2'")* with a 5 + a 2 + 1 = 0. 
Then the generator polynomial of the code Cs is 

M s (x) =x 6 +x 5 +x 4 +l 

and C s is a [31,25,4] binary cyclic code. Its dual is a [31,6, 15] cyclic code. Both codes 
are optimal. 

Example 3.9. Let (m,h) = (7,2) and a be a generator of GF(2 m )* with a 1 + a + 1 = 0. 
Then the generator polynomial of the code C s is 

M s (x) =x s +x 4 +x+l 

and C s is a [127,119,4] binary cyclic code. Itsdualisa [127,8,63] cyclic code. Bothcodes 
are optimal. 

When m is odd, the code Cs is optimal by the sphere packing bound and may be equiv- 
alent to the even-weight subcode of the Hamming code. When m is even, one can prove 
that C s is a [2'" — 1 , 2'" — 1 — m, 2] code and is almost optimal. We are not interested in this 
case as d = 2. 

3.3. Binary cyclic codes from the Welch APN function. In this subsection we study 
the code C s defined by the Welch APN function. Before doing this, we need to prove the 
following lemma. 

Lemma 3.10. Let m = 2t + 1 > 7. Let s°° be the sequence o/(@, where f(x) = x 2 ' +3 . Then 
the linear span L s of s°° is equal to 5m + 1 and the minimal polynomial M s (x) of s°° is 
given by 

Ms(x) = 

(x - l)m a -, (x)m a -3 {x)m aA 2t +1) (x)m a _ {2 , +2) (x)m a _ (2 , +3) (*) 

(13) 

where m a -j (x) is the minimal polynomial ofaT 1 over GF(2). 
Proof. By definition, we have 

Si = Tr(V + l) 2 ' +2+1 ) 

= Tr ((oc'') 2 ' +3 + (a'') 2 ' +2 + (a'') 2 ' +1 + (a'') 3 + a'' + l) 

m—l m—l m—l 

= £ (a') (2 ' +3)2J + E (a') (2 ' +2)2J + £ (aO (2 ' +1)2J + 

j=0 j=0 ,/=0 

m—l m—l 

(14) £(a'-) 3x2J +£(a'f + l. 

7=0 7=0 

We will prove that the following 2-cyclotomic cosets are pairwise disjoint: 

(15) Ci, C3, Cy+i, C21+2, C2'+3- 
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Note that two cyclotomic cosets are either identical or disjoint. Since C\ contains only 
powers of 2, it cannot be identical with any of the remaining four 2-cyclotomic cosets. 
We now prove that C3 OCy+j = for all j G {1,2,3}. Define 

A(hJ)=3x2 h -2 t -j 

where < h < m — 1. When h — m — 1 = 2f , we have 

A(h, j) = 2'" - 1 + 2'"- 1 - 2 1 - {j - 1). 

Note that < 2 m ~ 1 — 2' — (j — 1) < n. It follows that n does not divide A(hJ) in this case. 
When h < m — 2 = 2t — 1, it is easily checked that A(h,j) 7^ for any h as f > 3. In this 
case we have 

-n <-{2' + j) < A(hJ) = 2'"- 1 +2"'- 2 -2>-j<n. 

Hence n does not divide A(h,j) for all h < m — 2 = 2t — 1. It then follows that C3 flCy+j = 
for all j 6 {1,2,3}. 

One can similarly prove that the three cyclotomic cosets Cy+i , Cy+-i are pairwise 
disjoint. We omit the details here. 

We now prove that all the five cyclotomic cosets of (fl~5T > have size m. Clearly l\ = \C\ \ = 
l-\ = m. Note that 

gcd(2 2 ' +1 - 1,3) =gcd(2 2,+1 - 1,2 2 - 1) = 2S cd ( 2 ' +1 ' 2 ' -1 = 1. 

We have £3 = | C3 1 = £_3 = m. 

Since gcd(2 2 ' +1 - 1,2' - 1) = 1, we have 

gcd(2 2,+1 -l,2' + l) = gcd(2 2 ' +1 -l,2 2 '-l) 

_ 2S cd ( 2 ' +1 ' 2 ') - 1 

= 1. 

Hence £ 2 '+i = \Cz'+i\ = = m - 

We now compute 

gcd := gcd(2 2 ' +1 - 1,2' + 2) = gcd(2 2 ' +1 - 1,2'-' + 1). 

Note that 

2 2r+l _ j = 2 '+2(2'-l +1) _ (2'+ 2 + 1). 

We have gcd = gcd(2'+ 2 + 1,2' _1 + 1). Since 

2' +2 + l = 2 3 (2'- 1 + l)-(2 3 -l), 

we obtain that gcd = gcd(2'~ ! + 1,2 3 - 1). Let t\ — [(t - 1)/3J. Using the Euclidean 
division recursively, one gets 

gcd = gcd(2'- 1 - 3 ' 1 + l,2 3 -l) 

gcd(2°+l,2 3 -l) = l iff- 1=0 (mod 3) 
gcd^ + l^ 3 - 1) = 1 if f 1 = 1 (mod 3) 
gcd(2 2 + l,2 3 - 1) = 1 iff- 1=2 (mod 3). 

Therefore £ 2 '+2 = |Q'+2| = ^-(2'+2) = m. 

We now prove that gcd := gcd(2 2 ' +1 — 1,2' + 3) = 1. The conclusion is true for all 
1 < f < 4. So we consider only the case that f > 5. 

Note that 

2 2,+1 -l = (2' +1 -6)(2' + 3) + 17. 



10 



CUNSHENG DING 



We have gcd = gcd(2' +3,17). Since 

2' + 3 = 2'- 4 (2 4 + l)-(2'- 4 -3), 

we obtain that gcd = gcd(2'~ 4 — 3,2 3 — 1). Let fi = |_r / 4J . Using the Euclidean division 
recursively, one gets 

gcd = 



:d(2 ? - 1 - 4 " 


+ 


3x(-l)",2 3 - 


-1) 






gcd(2° + 


(" 


-1)''3,17) = 1 


iff 


= 


(mod 4) 


gcd(2' + 


(" 


-1)"3,17) = 1 


iff 


= 1 


(mod 4) 


gcd(2 2 + 


( 


-1)'!3,17) = 1 


iff 


= 2 


(mod 4) 


gcd(2 3 + 




-1)''3,17) = 1 


iff 


= 3 


(mod 4) 


= ^-(2'+3) 




m. 









Therefore iy+i = |C2 f +3| 

The desired conclusions on the linear span and the minimal polynomial M s (x) then 
follow from Lemma |2T2l (fT4l and the conclusions on the five cyclotomic cosets and their 
sizes. □ 

The following theorem provides information on the code C s - 

Theorem 3.11. Let m > 7 be odd. The binary code C s defined by the sequence of Lemma 
13.701 has parameters [2 m — 1,2'" — 2 — 5m, d] and generator polynomial M. s (x) of ( 1751 ), 
where d > 6. 

Proof. The dimension of C s follows from Lemma 13.101 and the definition of the code C s - 
We need to prove the conclusion on the minimum distance d of Cs- To this end, let C s 
denote the cyclic code with generator polynomial M s (x)/(x — 1). Then Q is the even- 
weight subcode of C s - 
Note that 

C\ UC 2 '+i UC 2 f + 2UC 2 < + 2 D {2',2 f + l,2'+2,2' + 3}. 

By the BCH bound, the cyclic code generated by the reciprocal of M s (x)/(x — 1) has 
minimum weight at least 5. So does Cs- Note that d is even. It then follows that d > 6. □ 

Example 3.12. Let m = 3 and a be a generator of - GF(2 m )* with O? + a + 1 =0. Then C s 
is a [7,3,4] binary code with generator polynomial 

M s (x) =x 4 +x 3 +x 2 + l. 

Its dual is a [7,4,3] cyclic code. Both codes are optimal. 

Example 3.13. Let m = 5 and a be a generator of 'GF(2 m )* with a 5 + a 2 + 1 = 0. Then 
the generator polynomial of the code Cs is 

M s (x) = x 16 +x 15 +x 13 +x n +x 8 +x 6 +x 3 + 1 

and Cs is a [31, 15,8] binary cyclic code. Its dual is a [31, 16,7] cyclic code. Both codes 
are optimal. 

Example 3.14. Let m = 7 and a be a generator of GF(2 m )* with a 1 + a + 1 = 0. Then the 
generator polynomial of the code Cs is 

M s (x) = x 36 + x 34 + x 33 + x 32 + x 29 + x 28 + x 27 + x 26 + x 25 + 
x 24 +x 21 +x 12 +X 11 +x 9 +x 7 +x 6 +x 5 +x 3 +X+ 1 

and Cs is a [127,91,8] binary cyclic code. 
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(16) l<h< 



3.4. Binary cyclic codes from the function f(x) = x 2 ' 1 . Functions over GF(2"') of the 
form f(x) = x 2 ~ l may have good nonlinearity @). Let h be a positive integer satistying 
the following condition: 

(m — 1 )/2 if m is odd and 
(m — 2)/2 if m is even. 

In this subsection, we deal with the binary code Q defined by the sequence s°° of (01, 
where f(x) = x 2 . The binary code of this subsection can be viewed as a special case 
of the code of Section 14.41 However, in the special case q = 2 we are able to obtain 
better results, and will need the special techniques of this subsection to handle the codes 
of Section [3~6l Hence, we have to treat the code of this subsection here separately. 

We first prove a number of auxiliary results on 2-cyclotomic cosets, which are stated in 
the following lemmas. 

Lemma 3.15. For any j with 1 < j < 2 h , the size lj = \Cj\ = m. 

Proof. Let 1 < j < 2 h — 1, and let u and v be any two integers with m — 1 > u > v > 0. 
Define 

A(j,u,v)=j2 u -j2 v = 2 v j(2 u - v -l). 

Note that 

gcd(2"- v - l,2 m - 1) = 2 gcd ("- v ' m ) - 1. 

If u — v = 1, A(j,u,v) = 2 v j is not divisble by n = 2™ — 1. We now consider the case that 
m — 1 > u — v>2. In this case, gcd(« — v,m) < m. It then follows that 

gcd(2"- v -l,2 m -l)<2 m / 2 -l. 

Note that 

1 <j<2 h -l < 2<"'- 1 )/ 2 - 1. 

It then follows that 

1 < jgcd(2"- v - 1,2'" - 1) < (2"' /2 - l)(2 (m - 1) / 2 - 1) < T - 1. 
Hence A(j, u, v) ^ (mod n) in the case m — 1 > u — v > 2. This completes the proof. □ 

Lemma 3.16. For any pair of distinct odd i and odd j in the set {1 , 2, ■ ■ ■ , 2 h — 1 }, C; H Cj — 
0, i.e., they cannot be in the same 2-cyclotomic coset modulo n. 

Proof. Define 

A] = ;2" - j and A 2 = ]2 m ~ u - i. 

Because i and j both are odd, A, ^ for both i. 

Suppose that i and j are in the same cyclotomic coset. Then n divides both Ai and A 2 . 
We distinguish between the following two cases. When u < h+ 1, we have 

-n < -{2 h -2) < 1 - ; < Ai < {2 h - l)2 /,+1 -j< n. 

In this case A] ^ (mod n). Hence, we have reached a contradiction. 
When u > h + 2, we have m — u<m — h — 2 and 

-n < -{2 h - 2) < 1 - i < A 2 < (2 h - \)2 m - h - 2 -j< n. 

In this case A 2 ^ (mod n). Hence, we have also reached a contradiction. This completes 
the proof. □ 
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We need to do more preparations before presenting and proving the main results of 
this subsection. Let f be a positive integer. We define T = 1} — 1. For any odd a 6 
{1,2,3,-- - ,T} we define 



e (r) 



1 T 

log 2 - 

a 



and 

B 

Then it can be verified that 



f: ) = {2'fl:/ = 0,l,2,...,ei r) -l}. 



U B® +1 = {1,2,3,-, T} 

l<2a+l<T 



and 

for any pair of distinct odd numbers a and bin { 1 , 2, 3, - • • ,7"}. 

The following lemma follows directly from the definitions of ei and Ba ■ 

Lemma 3.17. Let a be an odd integer in {0, 1 , 2. • • • ,T}. Then 

Bl', +l) = flW u { fl 2 £ « ' } ^ 1 < a < 2' - 1, 
B { a +l) = {a} if 2' + 1 < a < 2 ,+l - 1 , 
ei' +1) =ei f) + l(fl<a<2'-l, 
ei m) = l*/2' + l<a<2 m -l. 

Lemma 3.18. Lef ty denote the total number of odd w/ien a ranges over all odd 
numbers in the set { 1 , 2, • • • ,T}. Then ty = 1 and 

3 

for all t > 2. 

Proof. It is easily checked that tyj = 1, ty? = 3 and N4 = 5. It follows from Lemma [3. 171 
that 

ty =2'- 2 + (2'- 2 -M_i). 

Hence 

ty - 2'- 2 = 2'- 3 - (N,-i - 2'- 3 ) = 3 x 2'- 4 + (N t -2 - 2'~ 4 ) . 
With the recurcive application of this recurrence formula, one obtains the desired formula 
forty. □ 

Lemma 3.19. Let s°° be the sequence of^, where f(x) = x 2 _1 , h > 2 and h satisfies the 
conditions offtl6]). Then the linear span Lj of s°° is given by 

{ m{2 h + {-i) h - 1 ) 

(17) L. v = 



-j ifm is even 

^-f^ if mis odd. 



We have then 

(18) M s {x) = {x-lf^ J] »a-(W)W» 

l<2j+l<2 A -l 

where m a -j (x) is f/je minimal polynomial of<X~ ] over GF(2). 
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Proof. We have 



Tr(/(*+l)) = 



(19) 




„2;+l 



/ 



where the last equality follows from Lemma l3.16l 

By definition, the sequence of is given by s t = Tr(/(a' + 1)) for all t > 0. The 
desired conclusions on the linear span and the minimal polynomial M.,(jc) then follow 
from LerrrmaslUEH] |3T6] EESand Equation (Q3. □ 

The following theorem provides information on the code C s - 

Theorem 3.20. Let h>2. The binary code C s defined by the binary sequence of Lemma 
\3.19\ has parameters [2 m — 1,2'" — 1 — L s ,d] and generator polynomialW. s {x) of (ll8i . where 
Lj is given in ( 1771 ) and 

2 h ~ 2 + 2 if m is odd and h > 2 
2 /! - 2 +l. 



d> 



Proof. The dimension of C s follows from Lemma D.19| and the definition of the code C s - 
We now derive the lower bounds on the minimum weight d of the code. It is well known 
that the codes generated by M. s (x) and its reciprocal have the same weight distribution. It 
follows from Lemmas |3 . 1 91 and |3 . 1 7 1 that the reciprocal of M s (jc) has zeros a 7+ for all j 
in {2 ,, - 2 ,2 / '- 2 +l,-- - ,2 1 '- 1 - 1}. By the Hartman-Tzeng bound, we have d > 2 h ~ 2 + 1 . If 
m is odd, Cs is an even-weight code. In this case, d > 2 h ~ 2 + 2. □ 

Example 3.21. Let (m,h) = (3,2) and a be a generator of GF(2 m )* with a 3 
Then C s is a [7,3,4] binary code with generator polynomial 

M s (x)=x 4 +x 3 +x 2 + l. 

Its dual is a [7,4,3] cyclic code. Both codes are optimal. 

Example 3.22. Let (m,h) = (5,2) and abea generator of G¥(2 m )* with a 5 + a 2 



-oc+ 1 



1=0. 



Then the generator polynomial of the code C s is 

M s {x) =x 6 +x 5 +x 4 +l 
and C s is a [3 1 , 25 , 4] binary cyclic code and optimal. 

Example 3.23. Let (m,h) = (7,2) and a be a generator of GF(2 m )* with a 7 + a- 
Then the generator polynomial of the code Cs is 



1 = 0. 



h{x) 



1 
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and Cs is a [127, 1 19,4] binary cyclic code and optimal. 

Example 3.24. Let (m, h) = (7,3) and a be a generator o/GF(2 m )* with a 1 + a + 1 =0. 
Then the generator polynomial of the code C s is 

M s (x) = x 22 +x 21 +x 20 +x l8 +x ll +x 16 +x 14 + 

x l3 +x 8 +x 7 +x 6 +x 5 +x 4 + l 

and C s is a [127, 105, d] binary cyclic code, where 4 < d < 8. 

Remark 3.25. The code C s ofTheorem \3.20\ mav be bad when gcd(/i,m) ^ 1. In this case 
the function f{x) = x 2 ''~ l is not a permutation o/GF(2 m ). For example, when (m,h) — 
(6,3), Cs is a [63,45,3] binary cyclic code, while the best known linear code has parame- 
ters [63,45,8]. 

3.5. Binary cyclic codes from the first Niho APN function. The first Niho APN function 
is defined by f(x) = x e , where e = 2( m " 1 )/2 ^'""'V 4 - 1 and m = 1 (mod 4). Define 
h = (m — 1 )/4. We have then 

Tr(f(x + 1 )) = Tr f (x 2 '" + 1 ) (x + 1 )Em» 2 '" 

h-l 




The sequence 5°° of (|4]i defined by the first Niho function is then given by 

/2*-i 2''-i \ 

(21) s t = 1 +Tr f £ (a') 1+2 "' + £ (a')'j 

for all f > 0, where a is a generator of GF(2'")*. In this subsection, we deal with the code 
C s defined by the sequence s°° of ( f2TT >. To this end, we need to prove a number of auxilary 
results on 2-cyclotomic cosets. 

We define the following two sets for convenience: 

A = {0,l,2,---,2 /! -l}, B = 2 2l '+A = {i + 2 2h :ieA}. 

Lemma 3.26. For any j £ B, the size £j = \Cj \ = m. 

Proof. Let j = i + 2 , where i £ A. For any u with 1 <u<m—l, define 

A 1 (j, M )=;(2"-l) = (/ + 2 2 ")(2»-l), 

A 2 (j,u) - j(T'-'< - 1) = (/ + 2 2/ ')(2'"-" - 1). 

If £j < m, there would be an integer 1 < u <m—l such that A t (j,u) = (mod n) for all 
t £{1,2}. 

Note that 1 < u < m— 1. We have that Ai(;',m) ^ and A 2 (j,u) ^ 0. When u < 
m — 2h — 1 , we have 

2 h < Ai(;» < (2 2/! + 2 /! - l)(2"'- 2/, - 1 - 1) < n. 
In this case, A; (j,u) ^ (mod n). 
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When u > m — 2h, we have m — u< 2h and 

2 h <A 2 (j,u) < (2 2/l + 2 /? -l)(2 2/, -l) <n. 

In this case, A2(j,u) ^ (mod n). 

Combining the conclusions of the two cases above completes the proof. □ 

Lemma 3.27. For any pair of distinct i and j in B, C\ C\Cj = 0, i.e., they cannot be in the 
same 2-cyclotomic coset modulo n. 

Proof. Let i = i\+ 2 2h and j = j\ + 2 2h , where ;'i G A and j\ G A. Define 

Aj (i,j,u) = iT'-j = (i, +2 2h )2" - (/I +2 2/ '), 

A 2 (i,j,u) = j2>»-" - i = (j l +2 2 ")2' n - u - (h +2 2h ). 

If Q = Cy, there would be an integer 1 <u<m — \ such that A,(i,j,u) = (mod n) for 
all f G {1,2}. 

We first prove that Ai (i, j, u) ^ 0. When u = 0, Ai (i, 7, u)=i\— When 1 < u < 

m — 1 , we have 

Ai(/,y» >2i 1 +2 2h+l -2 2h -j l >0. 

Since 1 < m < m — 1, one can similarly prove that A2 (i , 7, m) > 0. 
When w < m — 2h — 1, we have 

-n< -2 2h <Ai(iJ,«) < (2 2/, +2 ,! -l)(2'"- 2/, - 1 -l) <«. 

In this case, Ai(i,j,u) ^ (mod n). 

When m > ;7i — 2/z, we have m — m < 2h and 

< A 2 (i,j,u) < (2 2h + 2 h - \)2 2h - h - 2 h < n. 

In this case, A2 («,,/,«) ^ (mod n). 

Combining the conclusions of the two cases above completes the proof. □ 

Lemma 3.28. For any i + 2 2h £ B and odd j G A, 

_/ Cyjf(U) = (0,l) 
otherwise. 



(22) C i+2 2hf)Cj 
Proof. Define 



A 1 (i,j,u)=j2 u -(i + 2 2h ), 

A 2 (i,j,u) = (i + 2 2h )2 m -"-j. 

Suppose C i+2 2h — Cj, there would be an integer < u < m — 1 such that A t (iJ,u) = 
(mod n) for all t G {1,2}. 
If u = 2h, then 

= Ai (/,j,h) = 2 2/, + 1 (;2 2/, -(/ + 2 2 ' 1 )) (mod n) 

= j2 m -i2 2h+i -2 m (modn) 

= ;-l-/2 2/,+ 1 (mod«) 

= j-\-i2 2h+l . 

Whence, the only solution of Ai (i,j,2h) = (mod n) is = (0, 1). 

We now consider the case that < u < 2h. We claim that Ai (i,j,u) ^ 0. Suppose on 
the contrary that A\(i,j,u) =0. We would then have 
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Because u < 2h and j is odd, there is an odd i\ such that ; = 2 u i\. It then follows from 
; < 2 h that u < h. We obtain then 

j = h+2 2h - u >h+2 h >2 h -l. 

This is contrary to the assumption that j G A. This proves that Ai (i, j, u) ^ 0. 

Finally, we deal with the case that 2h+ \ < u < Ah =m— 1. We prove that A2 (i, j,u)^Q 
(mod n) in this case. Since j is odd, A2O', 7^ 0. We have also 

A 2 (i,j» = /2'"-» + 2 '" +2/i -"-; 

< (2 ,, -l)2" , -" + 2 m - 1 -; 

< 2 m ~( h ~V +2 m_1 - ; 

< «. 

Clearly, A2 (i, 7, m) > —7 > — n. Hence in this case we have A2 (i, j, u) ^ (mod n). 

Summarizing the conclusions above proves this lemma. □ 

Lemma 3.29. Let m > 9 be odd. Let s°° be the sequence of ( 1271 ). Then the linear span L v 
of s°° is given by 

m (2(" 1 + 7 )/ 4 +(-l)("- 5 )/ 4 )+3 



(23) L. v 
We have also 



-j ifm = 1 (mod 8) 

m(2(™+ 7 >/ 4 + (-l)('"- 5 >/ 4 -6)+3 ., _ / j o \ 

3 '- — ifm = 5 (mod 8). 



2T-1 



I s (x) = (x-1) m „ 

,=0 a-'*- 2 



(x) m a - 2 ,-i(x) 



m-l 

1<2j+1<2T~ -1 
c (('"-l)/ 4 ) , 



mod 2=1 



(fm = 1 (mod 8); and 



m-l 

2T-1 



i. s (x)=(x-i) n 



;=1 a 



n-x(x) m a - 2 ,-i(x) 



m-l 

3<2j+l<2T~ -1 
„((-"-l)/ 4 ) , 



e 2;+l 



mod 2=1 



(h) 

ifm = 5 (mod 8), where m a -j (x) is the minimal polynomial of(X~ J over GF(2) and G^y+i 
was defined in Section \3J\ 



Proof. By Lemma [3.27l the monomials in the function 



'2"-\ 



(24) 



V i=0 



will not cancel each other. Lemmas l3.18l and l3.19l sav that after cancellation, we have 



(25) 



T '(t',)= Tr 



l<2j+l<2 A -l 
2;+l 



By Lemma [3.28l the monomials in the function of d24b will not cancel the monomials 
in the function in the right-hand side of d25l l if m = 1 (mod 8), and only the term x 2 ' in 
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the function of (1241 cancels the monomial x in the function in the right-hand side of (1251 1 if 
m = 5 (mod 8). 

The desired conclusions on the linear span and the minimal polynomial M. v (x) then 
follow from Lemmas 12.2113. 261 and Equation ( f20b . □ 

The following theorem provides information on the code Cs- 

Theorem 3.30. Let m > 9 be odd. The binary code C s defined by the sequence of '( 1271 ) has 

parameters [2 m — 1,2"' — 1 — l, s ,d] and generator polynomial Wl s (x), where L. s andM. s (x) 
are given in Lemma [3.29\ and the minimum weight d has the following bounds: 



(26) d > 



2 (m-i)/4 + 2 if m =\ (mod 8) 
2('«-i)/4 ifm = 5 (mod 8) 



Proof. The dimension and the generator polynomial of Cs follow from Lemma [3.291 and 
the definition of the code C s - We now derive the lower bounds on the minimum weight d. 
It is well known that the codes generated by M. s -(x) and its reciprocal have the same weight 
distribution. The reciprocal of M. s -(x) has the zeros a i+2 ~ ' for all i in {0, 1 , 2, • • • , 2 h - 1 } 
if m = 1 (mod 8), and for all i in {1,2, • • • ,2 h — 1} if m = 5 (mod 8). Note that Cs is an 
even-weight code. Then the desired bounds on d follow from the BCH bound. □ 

Example 3.31. Let m = 5 and a be a generator of GF(2 m )* with a 5 + a 2 + 1 = 0. Then 
the generator polynomial of the code C s is 

M s (x)=x 6 +x 3 +x 2 + l 

and C s is a [3 1 , 25 , 4] binary cyclic code and optimal. 

Example 3.32. Let m = 9 and a be a generator o/GF(2'")* with a 9 + a 4 + 1 = 0. Then 
the generator polynomial of the code Cs is 



l s (x) = x 46 +x 45 +x 4l +x 40 +x i9 +x 36 +x 35 + 

x 33 + x 28 + x 27 + x 26 + x 25 + x 24 + x 22 + x 2 
x 20 +x 19 +x 14 +x 12 +x 7 +x 4 +x 2 +X+ 1 



and C s is a [511, 465 , d] binary cyclic code, where d > 6. The actual minimum weight may 
be larger than 6. 

3.6. Binary cyclic codes from the Kasami APN function. The Kasami APN function is 
defined by /(x) = x e , where e = 2 2h —2 h + l and gcd(m, h) = 1 . The case h = 1 is covered 
by the Gold APN function. In this subsection, we have the following additional restrictions 
on h: 

m— 1 



^ifm=l (mod 4), 
if m = 3 (mod 4), 



-3 



(27) 2 < h < { m U 

2^ if m = (mod 4), 

^ifm = 2 (mod 4). 
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Note that 

Tr(/(jc+l)) = Tr('(jc + l)(jc+l)^o I 2' ,+i 
= Tr^(x+l)n(/ ,+ ' + l 

= TrjV+l)!^ 

/2*-l , 2''-l , N 

= Tr £ x 2 " i+l + £ x 2 "' 

\ 1=0 1=0 , 

/2''-l , 2*-l \ 

= Tr (Z^+ZA 

V i=0 i=0 / 



2 ; '-l , 2 ; '-l 

m— o 



(28) = Tr(^* i+2 
The sequence s°° of (01 defined by the Kasami function is then 

/2 h -l , 2*-l \ 

(29) * = Tr f £ (<x<) ! ' +2 + g (a')' j + 1 

for all t > 0, where a is a generator of GF(2 m )*. 

In this subsection, we deal with the code C s defined by the sequence s°° of ( |29l . It is 
noticed that the final expression of the function of (EHT l is of the same format as that of the 
function of ( l20b . The proofs of the lemmas and theorems in this subsection are very similar 
to those of Section [3~4l Hence, we present only the main results without providing proofs. 

We define the following two sets for convenience: 

A = {0,1,2,--- ,2 A -1}, B = 2'"- h +A = {i + 2 m - h :ieA}. 

Lemma 3.33. Let h satisfy the conditions of \27\ . For any j G B, the size lj = \Cj\ = m. 

Proof. The proof of Lemma [3.26| is easily modified into a proof for this lemma. The detail 
is left to the reader. □ 

Lemma 3.34. Let h satisfy the conditions of H27\) . For any pair of distinct i and j in B, 
Ci n Cj = 0, i.e., they cannot be in the same 2-cyclotomic coset modulo n. 

Proof. The proof of Lemma |3.27| is easily modified into a proof for this lemma. The detail 
is left to the reader. □ 

Lemma 3.35. Let h satisfy the conditions of H27j . For any i + 2" ? ~' 1 G B and odd j G A, 

c .«- nc '={o^L: <0,1) 

Proof. The proof of Lemma |3.28| is easily modified into a proof for this lemma. The detail 
is left to the reader. □ 



CYCLIC CODES FROM APN AND PLANAR FUNCTIONS 



19 



Lemma 3.36. Let h satisfy the conditions of K27\ . Let s°° be the sequence of \29\ . Then the 
linear span L s of s°° is given by 

m(2( A+2 +(-l/'- 1 )+3 



(31) L s = 

We have also 



-j ifh is even 

<2ft+ 2 + (-l)"-'-6)+3 . 

— j — if h is odd. 



ifh is even; and 



l s (x) = (X - 1) Y[ m a -,-2>»-'' W n m <*- 2 J- 1 ( x ) 
i=0 1<2j+1<2''-1 

mod2=1 



2"-l 

, (x) = (x - 1) Jl M 11 m a-y- 1 ( x ) 

(=1 3<2;+l<2 ;, -l 



E 2j+1 



mod 2= I 



z/ft is odd, where m a -j(x) is the minimal polynomial of ar ] over GF(2) and e^+i was 



defined in Section \3.1\ 

Proof. The proof of Lemma [3.29| is easily modified into a proof for this lemma. The detail 
is left to the reader. □ 

The following theorem provides information on the code C s . 



(32) d > 



Theorem 3.37. Let h satisfy the conditions of j27\) . The binary code C s defined by the 
sequence of \29\ has parameters [2 m — 1,2'" — 1 — l* s ,d] and generator polynomial M s (jc), 
where L s andWl s (x) are given in Lemma \3.36\ and the minimum weight d has the following 
bounds: 

2 h + 2 ifh is even 
2 h ifh is odd. 

Proof. The proof of Lemma 13.301 is easily modified into a proof for this lemma with the 
helps of the lemmas presented in this subsection. The detail is left to the reader. □ 

Example 3.38. Let (m,h) = (3,2) and a be a generator of G¥(2 m )* with a 3 +a+ 1 = 0. 
Then C s is a [7,3,4] binary code with generator polynomial 

M s (x) =x 4 +x 3 +x 2 + l. 

Its dual is a [7,4,3] cyclic code. Both codes are optimal. In this example, the condition of 
K27\ is not satisfied. So the conclusions on the code of this example may not agree with the 
conclusions of Theorem \3. 3 71 

Example 3.39. Let (m,h) = (5,2) and abe a generator o/GF(2™)* with a 5 + a 2 + 1 = 0. 
Then the generator polynomial of the code C s is 

M s (x) = 

x 16 +x u +x 10 +X 9 +X & +X 1 +x 5 +x 4 +x 3 +x 2 +x+ 1 

and Cs is a [31, 15,8] binary cyclic code. Its dual is a [31, 16,7] cyclic code. Both codes 
are optimal. In this example, the condition of K27\ is not satisfied. So the conclusions on 
the code of this example do not agree with the conclusions of Theorem \3 .37\ 
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Example 3.40. Let (m,h) = (7,2) and a be a generator o/GF(2'")* with a 1 + a+ 1 = 0. 
Then the generator polynomial of the code Cs is 



and C s is a [127,91,8] binary cyclic code. 

In this subsection, we obtained interesting results on the code C s under the conditions of 
(|27| |. When h is outside the ranges, it may be hard to determine the dimension of the code 
Cs, let alone the minimum weight d of the code. Hence, it would be nice if the following 
open problem can be solved. 

Open Problem 3.41. Determine the dimension and the minimum weight of the code C 
defined by the Kasami APN power function when h satisfies 



3.7. Open problems regarding binary cyclic codes from APN functions. In the previ- 
ous subsections of Section [3] we investigated binary cyclic codes from some APN func- 
tions. It would be good if the following open problems could be solved. 

Open Problem 3.42. Determine the dimension and the minimum weight of the code C s 
defined by the second Niho APN function X s , where e = 2(' n ~ 1 ^ 2 + 2( 3m ~ 1 ^ 4 — 1 and m = 3 
(mod 4). 

Open Problem 3.43. Determine the dimension and the minimum weight of the code C s 
defined by the Dobbertin APN function x' e , where e — 2 4 ' + 2 3 ' + 2 2 ' + 2' — 1 and m = 5i. 

A number of other types of APN functions f(x) were discovered in 016] HH]. The code 
Cs defined by these APN functions may also have good parameters. It would be interesting 
to investigate these codes. 

4. NONBINARY CYCLIC CODES FROM APN AND PLANAR FUNCTIONS 

In this section, q is a power of an odd prime p. Note that both APN and planar functions 
on G¥(q m ) exist. 

4.1. Cyclic codes from the planar function x 2 . In this subsection we study the code C s 
defined by the planar function f(x) = x 2 on GF(r). To this end, we need to prove the 
following lemma. 

Lemma 4.1. Let s°° be the sequence of '@, where f(x) = x 2 . Then the linear span L s of 
s°° is equal to 2m + N p (m) and the minimal polynomial M f (x) of s°° is given by 



M s {x) 




x li +x 12 +x 9 +x 7 +x 6 +x 5 + 1 



(33) 



< 



' m r->h>' J1 r-ifm 
^>h>'^ifm 
H^±>h>^ifm 
, i ¥>h>^ifm 



1 (mod 4), 
3 (mod 4), 
(mod 4), 

2 (mod 4). 




CYCLIC CODES FROM APN AND PLANAR FUNCTIONS 



21 



Proof. It is easily seen that 

s t = Tr((a' + 1) 2 ) 

m—l m—l 

(35) = Tr(l)+2£(ay +£(oO V . 

.7=0 .7=0 

It can be easily proved that l\ = l n -\ = £2 — @n-2 = tn and C\ n Co = 0- The desired 
conclusions on the linear span and the minimal polynomial M s (x) then follow from Lemma 
EI]and 03}. □ 

The following theorem provides information on the code C s . 

Theorem 4.2. The code C s defined by the sequence of Lemma \4.1\ has parameters [n,n — 
2m — Np(tn),d] and generator polynomial W. s {x) of A34j , where 

d = 4 if q = 3 and N p (m) = 0, 

4 < d < 5 ifq = 3 and N p {m) = 1, 

3 < d < 4 ifq > 3 and N p (m) = 1, 

d = 3 ifq > 3 and N p (m) = 0. 



Proof. The dimension of C s follows from Lemma |4T| and the definition of the code C s - We 
need to prove the conclusion on the minimum weight d of Cs- The code C s of this theorem 
has the same weight distribution as the dual code in Theorem 1 1 in ifTTl when m = 
(mod p) and has the same weight distribution as the even-like subcode of the dual code 
in Theorem 1 1 in IfTTl when m ^ (mod p). This is because the generator polynomial of 
the code C s of this theorem and that of the dual code in Theorem 1 1 in IfTTl are reciprocals 
of each other when m = (mod p), and the generator polynomial of the code C s of this 
theorem and that of the even-like subcode of the dual code in Theorem 11 in IfTTl are 
reciprocals of each other when m ^ (mod p). The conclusions on d then follow from 
those on the minimum weight of the dual code in Theorem 1 1 in IfTTl . □ 

Remark 4.3. Both this paper and 11 11 employ planar functions in constructing codes. 
The two approaches are different in general. The approach of this paper always produces 
cyclic codes. The approach of |1 1| gives cyclic codes only when the planar function f{x) 
is a power function. Another difference is that the two approaches produce codes with 
different dimensions. However, for this quadratic planar function f{x) = x 2 , the codes 
obtained with the two approaches are closely related. The relation between the two codes 
is made clear in the proof of Theorem \4.2\ 



Example 4.4. Let {m,q) — (2,3) and a be a generator of 'GF(r)* with oc 2 + 2oc + 2 = 0. 
Then C s is a [8,3,5] ternary code with generator polynomial 

M s (x) = x 5 + 2x 3 + x 2 + x + 1 . 

This cyclic code is an optimal linear code. 

Example 4.5. Let {m,q) = (3,3) and a be a generator of 'GF(r)* with a 3 +2a+ 1 = 0. 
Then C s is a [26,20,4] ternary code with generator polynomial 



l s (x) =x b +x 5 +x 3 + 2x + 2 



This cyclic code is an optimal linear code. 
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Example 4.6. Let {m,q) = (4,3) and a be a generator of GF(r)* with oc 4 + 2a 3 +2 = 0. 
Then Cs is a [80,71,5] ternary code with generator polynomial 

M s (x) = x 9 + 2x % + x 1 + 2x 6 + x 4 + x 2 + 1 . 

This cyclic code is an optimal linear code. 

Example 4.7. Let (m,q) = (2,5) and a be a generator ofGF(r)* with a 2 +4a + 2 = 0. 
Then Cs is a [24, 19,4] cyclic code over GF(5) with generator polynomial 

M s (x) =x 5 + 3x 4 + 2x i + 3x 2 + 3x + 3. 

This cyclic code is an optimal linear code. 

Example 4.8. Let (m,q) = (3,5) and a be a generator ofG¥(r)* with a 3 + 3a + 3 = 0. 
Then C s is a [124, 117,4] cyclic code over GF(5) with generator polynomial 

M s (x) = x 1 + 4y 6 + 4x 4 + 3x 2 + 3 . 

This cyclic code is an optimal linear code. 

4.2. Cyclic codes from the Dembowski-Ostrom planar function. The Dembowski-Ostrom 
planar function is given by f(x) = x q + , where mj gcd(m,K) and q are odd. In this sub- 
section we study the code C s defined by this planar function. To this end, we need to prove 
the following lemma. 

Lemma 4.9. Let m be odd. Let s°° be the sequence of ^(0, where f(x) is the Dembowski- 
Ostrom planar function. Then the linear span L lS of s°° is equal to 2m + Np(m) and the 
minimal polynomial M s of s°° are given by 

(36) M s (jc) = (x - lfpMm a -i (*K- ( „k +1) (x) 

where m a -j(x) is the minimal polynomial ofOT 1 over GF(g), Np(i) = if i = (mod p) 
andNp(i) = 1 otherwise. 



Proof. It is easily seen that 



-l < 



St = Tr((a' + 1)" 

m—l m—l 

(37) = Tr(l) + 2^(a')' ?J + ^(a') (,?K+lV . 

Since mj gcd(m,K) is odd, gcd(2K,m) = gcd(K,m). Because q is odd, gcd(g K — 1 , q ,K - 
1) = 1. It then follows that 



gcd(<7 K + 1,^-1) = 



gcd( ? 2K -l,^'"-l) 
gcd(<7 K -l,<7'"-l) 

^gcd(2K,ni) _ y 



^gcd(K.m) _ l 
= 1. 

Therefore, the size of the q-cyclotomic coset contating q K + 1 is m. Clearly, C\ nC ? t + i = 0. 
The desired conclusions on the linear span and the minimal polynomial M s (x) then follow 
from Lemma |2~2l and d37| i. □ 

The following theorem provides information on the code C s - 
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Theorem 4.10. The code Cs defined by the sequence of Lemma \4. 9\ has parameters [n, n — 
2m — Np(m),d] and generator polynomial M. s (x) of A36[ , where 



Proof. The dimension of Cs follows from Lemma l4~9l and the definition of the code Cs- We 
need to prove the conclusion on the minimum distance d of Cs- The code Cs of this theorem 
has the same weight distribution as the dual code in Theorem 15 in ifTTl when m = 
(mod p) and has the same weight distribution as the even-like subcode of the dual code 
in Theorem 15 in IfTTl when m ^ (mod p). This is because the generator polynomial of 
the code C s of this theorem and that of the dual code in Theorem 15 in IfTTl are reciprocals 
of each other when m = (mod p), and the generator polynomial of the code C s of this 
theorem and that of the even-like subcode of the dual code in Theorem 15 in IfTTl are 
reciprocals of each other when m ^ (mod p). The conclusions on d then follow from 
those on the minimum weight of the dual code in Theorem 15 in IfTTl . □ 

Remark 4.11. Although the approach of this paper and that of 1111 to the construction of 
linear codes with planar functions are different, for the Dembowski-Ostrom planar func- 
tion, the codes obtained with the two approaches are closely related. The relation between 
the two codes is made clear in the proof of Theorem \4.10\ 

Example 4.12. Let (m,K,q) = (3,1,3) and abea generator of 'GF(r)* with a 3 + 2a + 1 = 
0. Then C s is a [26,20,4] ternary code with generator polynomial 



This cyclic code is an optimal linear code. 

Example 4.13. Let (m,K,q) = (4,4,3) and a be a generator of GF(r)* with a 4 + 2a 3 + 2 = 
0. Then Cs is a [80,71,5] ternary code with generator polynomial 



This cyclic code is an optimal linear code. 

4.3. Cyclic codes from the planar functions x 10 — ux 6 — u 2 x 2 over GF(3" ! ). Throughout 
this subsection, let q = 3 and let m be odd. A family of planar functions f{x) = x 10 — ux 6 — 
u 2 x 2 on GF(r) was discovered in lfT4lfT6l . where u e GF(r). In this subsection we study 
the code C s defined by these planar functions. To this end, we need to prove the following 
lemma. 

Lemma 4.14. Let s°° be the sequence o/@, where f(x) = x lQ — ux 6 — u 2 x 2 . Then the 
linear span L s ofs°° is given by 




4<d <5 



3<d<4 



if q = 3 and m = (mod p), 

if q = 3 and m^0 (mod p), 

if q > 3 and m = (mod p), 

if q > 3 andm ^ (mod p). 



M s (x) = x 6 + 2x 5 + 2x 4 +x 3 +x 2 + 2x + 1 . 



M s (x) = x 9 + 2x 8 +x 7 + 2x 6 +x 4 +x 2 + 1 . 




and the minimal polynomial M s (x) ofs°° is given by 




where m, 
and 8„ = 



-j(x) is the minimal polynomial ofa 1 over G¥(q), 8„ = ;/Tr(M 2 +u - 1) = 
1 otherwise. 
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Proof. By definition, we have 

f(x+l) = x w +x 9 -ux 6 -u 2 x 2 + (1 +u + u 2 )x+(l -u-u 2 ). 
It then follows that 

Tr(/(x+l)) = 

Tr (.x 10 - (u 3 "" 1 + u 2 )x 2 + (u 2 +u- l)x\ - Ti(u 2 +u- 1). 

By definition, 

(38) s t = Tr ((a 1 ) 10 - (u 3 " 1 ' 1 +u 2 )(a!) 2 +va'} -Tr(v), 

where v = u 2 + u — 1 . 

It can be easily proved that 

4 = 4-i =h = 4-2 = 4o = 4-io = m 

and that the three g-cyclotomic cosets C\,C2 and C\q are pairwise disjoint. 
We now prove that v — iP' -\-u — 1 =^= for all u G GF(r). Suppose 

(39) u 2 + u -1=0. 
Multiplying both sides of d39l by u yields 

(40) m 3 + u 2 - u = 0. 
Combining (|39l and (|40b gives 

(41) m 3 + m + 1 = (u- 1) 3 + (m- 1) =0. 

Since m is odd, —1 is not a quadratic residue in GF(r). The only solution of y 3 +y = is 
y = 0. Hence the only solution of fiTt is u = 1. However, u = 1 is not a solution of d39l . 
Hence v ^ for all m. 

Finally m 3 " + m 2 = if and only if u 6 + u = 0. The desired conclusions on the linear 
span and the minimal polynomial M s (x) then follow from Lemma [Z2l Equation ( 1381 and 
the conclusions on the cyclotomic cosets and their lengths. □ 

The following theorem provides information on the code C s . 

Theorem 4.15. The code C s defined by the sequence ofLemma \4. 14\ has parameters [n,n — 
L s , d] and generator polynomial M s (x), where L s and M. s (x) are given in Lemma \4.14\ and 

5 < d < 8 ifu 6 + u^0 and 8„ = 1; 
4<d<6ifu 6 + u^0 and 8„ = 0; 
3 < d < 6 if u 6 + u = anc/ 8„ = 1 ; 
3 < <i < 4 ;/ m 6 + u = a«<f 8„ = 0. 

Proof. The dimension of C s follows from Lemma 14.141 and the definition of the code C s - 
We need to prove the conclusions on the minimum distance d of Cs- It is known that the 
codes generated by any polynomial g(x) and its reciprocal have the same weight distribu- 
tion ifg(0) 7^0. 

When m 6 + u = 0, the reciprocal of M s (x) has root a 9 and a 10 . In this case d > 3 by the 
BCH bound. The upper bounds on d follow from the sphere-packing bound. 

When u 6 + u ^ 0, the reciprocal of M s (x) has roots a' for i 6 {1,2,3} and for all i € 
{0, 1,2,3} if 8„ = 1. The lower bounds on d then come from the BCH bound. The upper 
bounds on d follow from the sphere-packing bound. □ 
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Remark 4.16. The Coulter-Mathews planar function x 10 + x 6 — x 2 was employed in 111 II 
to construct linear codes, which are not cyclic. However, the codes of this subsection are 
cyclic. On the other hand, the dimension of the codes of this subsection has two different 
possible values, as more planar functions are employed in this subsection. This demon- 
strates that the two construction approaches of this paper and Q 1| are different. 

It is interesting to note that the dimensions of the codes defined by x 10 +x 6 — x 2 and 
x — x^ — x 2 are different though both are quadratic planar trinomials. 

Example 4.17. Let (m,q,u) = (3,3,1) and a be a generator of 'GF(r)* with a 3 +2a+ 1 = 
0. Then Cs is a [26, 17,5] ternary code with generator polynomial 

M, (x) = x 9 + x s + Ix 1 + 2x 6 + 2x 5 + x 4 + x 3 +x 2 + 2x + 1 . 

This cyclic code is an optimal linear code. 

Example 4.18. Let (m,q,u) — (3,3,-1) and a be a generator of GF(r)* with a 3 +2a + 
1=0. Then C s is a [26,20,4] ternary code with generator polynomial 



This cyclic code is an optimal linear code. 

Example 4.19. Let (m,q,u) — (3, 3, a) and a be a generator of G¥(r)* with a 3 +2a+ 1 = 
0. Then C s is a [26, 16,6] ternary code with generator polynomial 



This cyclic code is an optimal linear code. 

4.4. Cyclic codes from f(x) = xte* -1 )A ?-1 ). Let h be a positive integer satistying the 
following condition: 



In this subsection, we deal with the code C s defined by the sequence s°° of where 
f{x) = ;t(< : /'~ 1 )/(<7- 1 ). When h = l, the code C s has parameters [n,n — m — N p (m),d], where 
d = 3 if Np(ra) = 1 and d = 2 if N p (m) = 0. When h = 2, the code C s become a special 
case of the code in Section |4~2l Therefore, we assume that /; > 3 in this subsection. 

In order to study the code C s of this subsection, we need to prove a number of auxiliary 
results on g-cyclotomic cosets. 

Lemma 4.20. Let h satisfy the condition oft \42\) . For any {i\ , 12, • • • , it) with < i\ < ('2 < 
• • • < i t < h— 1, the size l{ = \Cj\ = £„_,■ = m, where i = q° + Y!j=i < i' i - 

Proof. We prove the conclusion of this lemma only for the case that m is even. The con- 
clusion for m being odd can be similarly proved. 
Let u be any integer with m — 1 > u > 1 . Define 



M. v (x) = x 6 + 2x 5 + 2x 4 + x 3 +x 2 +2x + 2. 



M s (x) = x 10 + x* + 2x 5 + x 2 +2x + 2. 



(42) 




(m — 1 )/2 if m is odd and 



Ai=»(9"-1), A 2 = /(<?' 

Clearly A,- ^ for both / asm- 1>u>1. 
If u < m/2, we have 

Ai = 1(9" -1) 



in — it 



i). 



. a m-2r m— 2H-2 m—2 in 

< (q U + q^~ +q^^ +--- + q^){q? -I) 



< n. 
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On the other hand, we have obviously that Ai > —i > —n. Hence we have Ai ^ (mod n) 
when u < m/2. 

If u > m/2, then m — u< m/2. In this case one can similarly prove that —n < A2 < n. 
So we have A2 ^ (mod n) when u > m/2. 

Summarizing the conclusions above proves the desired conclusions for m being even. 

□ 



Lemma 4.21. Let h satisfy the condition of A42t . For any pair of distinct i = q° + Y!i=i 
and j = q° + £/=i 9^ with 

< i\ <i%< ■■■i t <h — l and < j\ < 72 < • • • f < h — 1 , 

Ci H Cj = 0, i.e., i and j cannot be in the same q-cyclotomic coset modulo n. 

Proof. Let u be any integer with < u < m — 1. Define 

Ai = iq" - j and A 2 = jq m ~ u - i. 

Notice that ; = 1 (mod q) and j = 1 (mod q). We have that A,- ^ for both i as ; ^ /'. 
Suppose that i and j were in the same cyclotomic coset. Then n would divide both Ai 
and A2 . 

We prove the desired conclusion only for the case that m is odd. The conclusions for m 
being even can be similarly proved. 

We distinguish between the following two cases. When u < (m — 1 )/2, we have 

Ai = iq" - j 

. a m-2t+l m-2t+3 m— 1 . m— 1 

< (q° + q~^~ +q^~ +--- + q^)q^ -j 

< n. 

On the other hand, we have obviously that Ai > —j > —n. Hence we have Ai ^ (mod n) 
when u < (m — 1 )/2. 

When u > (m — l)/2, we have m — u < (m — l)/2. In this case one can similarly prove 
that — n < A2 < n. In this case A2 ^ (mod n). 

Summarizing the conclusions of the two cases above proves the desired conclusion for 
m being odd. □ 

We need to do more preparations before presenting and proving the main results of this 
subsection. 

Let J > t > 2, and let N(J,t) denote the total number of vectors (ii , 1*2, • • • ,«V-i) wth 
1 < h < h < ■ ■ ■ < if-i < J- By definition, we have the following recursive formula: 

(43) N(/,0= £ Na*-1)- 
By definition, we have 

(44) N(J, 2) = / - 1 for all J > 2 
and 

(45) N(/,3) = ( y ~ i y~ 2 ) for a n j > 3. 
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It the follows from <(43j, (@4j and (@3]l that 



N(/,4) = £Na,3) 

;=3 



(46) 



By definition, we have 



'-! (/- 1)(/-2) 

y=3 2 
/ 3 -6/ 2 + ll/-6 



(47) N(/,/) = lforall?>2. 



For convenience, we define N(J, 1) = 1 for all / > 1. 

Lemma 4.22. Let h satisfy the condition of \42\ . Let s°° be the sequence of ©, where 
f(x) = x («*-i)/(9-i). Then the linear span L s and minimal polynomial M 4 (x) of s°° are 
given by 



and 



( h-lh-l \ 

L s = N p {h) + £ £ N P (h-u)N(u,t) m + Np(m) 

V f=i«=i / 



l s (x) = (x-l)^m^(xfpW Y\ m a _ (<p+qU) (x) 

l<a<h-l 
().-»)= 1 

ft-1 

x n n n - ( ^ lf W)W 

t=2 t<„<h-i 1< (1 <•••<!,_!<« cx J- 1 
Np(/i-w)=l 



Proof. Define 



x = a'. 
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Then we have 



s, = Tr((x+ 1)^=0 



'h-\ 



Tr n Al 



, '=0 



Tr(l)+Tr 



f=l 0<ii<-i' r <A-l 



= Tr(l)+/jTr(x)+Tr 



Tr 



L(*-ii^ 

.'l = 1 

t=2 !'l = l I2=/l + l ! ( =! t _l+l 



Tr(l)+/jTr(x)+Tr 



(48) 



Tr 



/i-i/i-i 



t=2i,=t l<ii<—</ t _i<! ( 



The desired conclusions on the linear span and the minimal polynomial M s (x) then 
follow from Lemmas E21 l4~20l |4~2T1 and Equation dHJ . □ 

The following theorem provides information on the code C s - 



Theorem 4.23. The code C s defined by the sequence ofLemma \4.22\ has parameters [n,n — 
h s ,d] and generator polynomial Wl s (x), where L s and M s (x) are given in Lemma \4.22\ 



Proof. The dimension of C s follows from Lemma |4. 221 and the definition of the code C s . 

□ 

As a corollary of Theorem l4.23l we have the following. 



Corollary 4.24. Leth~3. The code Ct of Theorem \4~23\ has parameters [n,n — li S ,d] and 
generator polynomial M s (x) given by 



l s (x) = {x- l) N ?Mm a -i (x)m a - 1 -,(x)m a _ 1 _ g2 Wm^,^ (x) 



if p ^ 3; and 

if p — 3, where 
(49) 

In addition, 



f 4m + N p (/n)i/p^3 
4 \ 3m + N p (m) f/p = 3. 



3 < c/ < 8 if p = 3 and N p (m) = 1 
3 < c/ < 6 if p = 3 and N p (m) = 
3<c/<8 z/>>3. 
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Proof. We need to prove only the bounds on the minimum weight of this code. The upper 
bounds on d follow from the sphere-packing bound and the dimension of the code. In both 
cases, the reciprocal of M s (x) has the roots a q+q ' and a +q+q ' . It then follows from the 
BCH bound that d > 3. □ 

Open Problem 4.25. For the code C s of Corollary \4.24\ do the following lower bounds 
hold? 

5 when p = 3 and N p (m) = 1 
^ ^ 4 when p = 3 and N p (m) = 
— 6 when p > 3 and N p (w) = 1 
5 when p > 3 and N p (m) = 0. 

Example 4.26. Let (m,h,q) = (2,3,3) andabe a generator of 'GF(r)* with a 2 + 2a + 2 = 
0. Then Cs is a [8,2,6] ternary code with generator polynomial 

M s (x) = x 6 + 2x 5 +2x 4 + 2x 2 +x+l. 

This cyclic code is optimal. Notice that h > m/2. Hence, the parameters of this code do 
not agree with those of the code in Corollarv \4.24\ In this case f(x) is a permutation. 

Example 4.27. Let (m,h,q) = (3,3,3) and abea generator of 'GF(r)* with a 3 +2a+ 1 = 
0. Then Cs is a [26,26, 1] ternary code with generator polynomial M 4 (x) = 1. This cyclic 
code is optimal as it is MDS. Notice that h > (m — l)/2. Hence, the parameters of this 
code do not agree with those of the code in Corollary \4.24\ In this case f(x) is not a 
permutation. In fact, gcd((q h — \)/{q— l),q m — 1) = 13. 

Example 4.28. Let (m,h,q) = (4,3,3) and a be a generator of 'GF(r)* with oc 4 +2oc 3 +2 = 
0. Then C s is a [80,69,5] ternary code with generator polynomial 

M s {x) =x 11 +2x % + 2x 6 + 2x 5 +2x 4 +x 3 +2x 2 +x + 2. 

This is an almost optimal linear code. The known optimal linear code has parameters 
[80,69,6] which is not cyclic. Notice that h > m/2. Hence, the parameters of this code do 
not agree with those of the code in Corollarv \4.24\ In this case f(x) is a permutation. 

Example 4.29. Let (m,h,q) = (5,3,3) and abea generator of 'GF(r)* with a 5 +2a+ 1 = 
0. Then C s is a [242, 226, d] ternary code with generator polynomial 

M s (x) = x 16 + 2x 14 + 2x 12 + 2x 11 +x lQ +x 9 +x 6 +x 3 +2x 2 + 2. 

Notice that h > m/2. However, the parameters of this code do agree with those of the code 
in Corollarv \4.24\ In this case f(x) is a permutation. 

Example 4.30. Let (m,h,q) = (6,3,3) and a be a generator o/GF(r)* with a 6 +2a 4 + 
a 2 + 2a + 2 = 0. Then C s is a [728, 710, d] ternary code with generator polynomial 

M s (x) = x 18 + 2x 15 + 2x 14 + 2x I3 + 2x n +x 10 

+2x 9 + x 8 + x 6 + 2x 4 +x i +x 2 + 2. 

Notice that h — m/2. Hence, the parameters of this code agree with those of the code in 
Corollarv \4.24\ In this case f(x) is not a permutation. In fact, gcd((q h — l)/(q— \ ),q m — 
1) = 13. 

Example 4.31. Let (m,h,q) = (2,3,5) and abea generator of 'GF(r)* with a 2 +4oc + 2 = 
0. Then Cs is a [24, 16,5] cyclic code over GF(5) with generator polynomial 

M s (x)=i 8 + x 1 + 2x 4 + 2x 3 + 3x 2 + 4x + 2 . 
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The best linear code known has parameters [24, 16,6] which is not cyclic. Notice that h > 
tn/2. Hence, the parameters of this code do not agree with those of the code in Corollary 

WM 

Example 4.32. Let (m,h,q) = (6,3,5) and a be a generator o/GF(r)* with a 6 + oc 4 + 
4a 3 + a 2 + 2 = 0. Then Q is a [15624, 15599, d] cyclic code over GF(5) with generator 
polynomial 

M s (x) = x 25 +x 24 + 3x a +2x 22 + 3x 2l +x 20 + 2x 19 + 

4x 18 + 4x 11 +x 16 + 2x l4 + 4x 12 + 2x ll + 3x 10 + 
4x 8 + Ax 6 + Ax 5 + x 4 + 4x 3 + x 2 + 4. 

Notice that h = m/2. Hence, the parameters of this code agree with those of the code in 
Corollary WM 

4.5. Cyclic codes from the Coulter-Mathews planar function. Throughout this subsec- 
tion, let q = 3, and r = q m as before. Let He a positive integer satistying the following 
conditions: 



(50) 



3 <h< 



h is odd, 
gcd(m,h) = 1, 

(m — l)/2 if m is odd and 
m/2 if to is even. 

In this subsection, we deal with the code C s defined by the sequence s°° of (@}, where 
f(x) — x^ 'I 2 . When /; = 1, the code C s becomes the code of Section |4~Tl Therefore, we 
consider the case h > 3 in this subsection. The code of this subsection is related to the code 
of Section l4~4l so we need to use some of the notations, symbols and lemmas of Section 

sa 

In order to study the code C s of this subsection, we need to prove a number of auxiliary 
results on g-cyclotomic cosets. 

Lemma 4.33. Let h satisfy the third condition of \50h For any (ii , 12) ' " ' Jt) with < 
i\ < i% < ■■■it < h — 1, the size li = \Cj\ = £„_,■ = to, where i = 2 + Y!j=\ 3 lJ . In addition, 

h = 4-2 = m. 

Proof. The proof of Lemma |4. 201 is easily modified into a proof of this lemma. We omit 
the details here. □ 

Lemma 4.34. Let h satisfy the third condition of ( I5QI ). For any pair of distinct i = 2 + 
Z' u=1 3'" and j = 2 + H u=l V" with 

< ;'i < 22 < • • • U < h — 1 and < j\ < 72 < • • -ft < h — 1, 

C; n Cj = 0, i.e., i and j cannot be in the same q-cyclotomic coset modulo n. In addition, 

• c 2 nCi =0. 

• C2 n C 1+ yj i y u = 0, where 1 < h < ■ ■ ■ < i t < h — 1. 

• C2 H C 2+ yj 31'a = 0» where 1 < ?'i < ■ ■ • < i t < h — 1. 

' C 2 + tL l y"^ c ^ l y»= %where 

1 < i\ < • • • < if 1 < h — 1 and 1 < i\ < ■ ■ ■ < i t2 < h — 1. 

Proof. The proof of Lemma l4.21l can be modified into a proof of this lemma. We omit the 
details here. □ 
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Lemma 4.35. Let h satisfy the third condition of (1501). Let s°° be the sequence of^, where 
f{x) = x^ + 1 )/ 2 . Then the linear span L s and minimal polynomial M s (x) of s°° are given 
by 



and 



Ls = N 3 (m) + N 3 (h - i + 1) J m + 

(h h-l h-l \ 

£N(A,0 + L£N 3 (A-% + l)N(^/) m 
(=2 r=2 /',=' / 



l s (x) = (x-l) N ^ m \n a - l (x) N ^ h+l hn a - 2 (x)x 

h-l 

n n m - (2+ ^ 1 3V)W x 

f=l l<»i<— <^<A— 1 « J- 1 

II m a-('+ 3 ") W x 
l<a<fc-l 
N 3 (*-u+l)=l 

n n n ".^.^w. 

%(A-(,+I)=l 



where ^3(7) andfi{j,t) were defined in Sections \2J\ and \4~4\ respectivelv. 
Proof. Note that 



1/7,1 ft-l 



Define x = a' and 



/*(*)= Tr ((x + l)#=o 3 ") 
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Then we have 



s t = Tr((*+l) 1+ ^ 

= Ti(x(x+1)*& 3 ')+Mx) 



Tr(x)+Tr 



h 

E 



1+^=1 & 



0<»'i<- -<i,<h-\ 



+ fh{x) 



= f h {x)+Tr{x)+Tr 



h-\ 

E 

.'1=0 



Tr 



/; 

E 



;=2 \0<!'i<- <i ( <ft-l 
2\ 



A(x)+Tr(x)+Tr(x z )+Tr 



E* 

'i=i 



l+3'l 



(51) 



Tr 



Tr 



/; 

E 



£ x 2 +^=i 3 ^ 

t=2 \1<i 2 <-<z',</i-1 y 

Ef E v ILi! " 

r=2 \l<ii< -<! t <A-l 
Using the expression of ( |48T > for //, (x) and merging terms in dBTt . we obtain 



(52) 



Tr 



Tr 



Tr 



Tr(l) + (/i + l)Tr(x)+Tr(x 2 ) 

"t(h-h+iy +yi 

<i = 1 

tf E * 2+i -' 3 " 

t=2 \l<i 2 < - <i t <h-\ 

EE(*-hi) E - I+E - l3V 

t=2i,=t l<i'i<— <!,_!</( 



The desired conclusions on the linear span and the minimal polynomial M s (x) then 
follow from Lemmas E2 021 S33] E2H H3U and Equation dH). □ 



The following theorem provides information on the code C s - 

Theorem 4.36. The code C s defined by the sequence of Lemma \4.35\ has parameters [n 7 n — 
TL S , d] and generator polynomial Wl s (x), where L s . and M. s (x) are given in Lemma 14.351 

Proof. The dimension of C s follows from Lemma l4.35l and the definition of the code C s - 

□ 

Remark 4.37. The Coulter-Mathews planar function f{x) = x^ +'V 2 was employed in 
11 11 to construct cyclic codes whose dual codes have dimension n — 2m, which is indepen- 
dent of h. However, the dimension of the code of Theorem \4. 361 depends on h. This once 
again shows the difference of the construction approach of this paper and that of 11 II . 

As a corollary of Theorem [436] we have the following. 
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Corollary 4.38. Let h = 3. The code C s of Theorem \4.36\ has parameters [n,n — L v ,c/] and 
the generator polynomial M s (x) given by 

M s (x) = (x-lf^m a -i(x)m a -2(x)m a - 5 (x)x 
m a -w (x)m a -u (x)m a -i3 (x)m a -u (x) 



where 



In addition, 



L. s =7m + N 3 (m). 



5<d<\6 ifN 3 (m) = l 
4<d<16 z/N 3 (m)=0. 

Proof. We need to prove only the bounds on the minimum weight of this code. The upper 
bound on d follows from the sphere-packing bound and the dimension of the code. In both 
cases, the reciprocal of M s (i) has the roots a' for all i £ {1,2,3}. When Na(m) = 1, the 
reciprocal of M s (x) has the additional root a . The lower bounds then follow from the 
BCH bound. □ 

Open Problem 4.39. For the code C s of Corollarv \4.38~\ do the following lower bounds 
hold? 



d> 



when N p (m) = 1 
when N p (m) = 0. 



Example 4.40. Let (m,h,q) = (2,3,3) and abea generator of 'GF(r)* with a 2 +2oc + 2 = 
0. Then Cs is a [8,3,5] ternary code with generator polynomial 

M s (x) = x 5 + 2x 3 +x 2 + x + 1 . 

This cyclic code is optimal. Notice that h > m/2. Hence, the parameters of this code do 
not agree with those of the code in Corollar\ \4.38\ 

Example 4.41. Let (m,h,q) = (4,3,3) and a be a generator of 'GF(r)* with oc 4 + 2oc 3 +2 = 
0. Then C s is a [80,69,5] ternary code with generator polynomial 

M. s (x) =x ll + 2x 8 + 2x 6 + 2x 5 + 2x 4 +x 3 + 2x 2 +x + 2. 

This is an almost optimal linear code. The known optimal linear code has parameters 
[80,69,6] which is not cyclic. Notice that h > m/2. Hence, the parameters of this code do 
not agree with those of the code in Corollarv \4.38\ In this case fix) is a permutation. 

Example 4.42. Let (m,h,q) = (7,3,5) and a be a generator of 'GF(r)* with a 7 +2a 2 + 1 = 
0. Then C s is a [2 1 86, 21 36, d] cyclic code over GF(5) with generator polynomial 

M s (x) 



x 50 4 


-x 49 +x 4& + 2x 47 + 2x 46 + 


x 45 + 


2x 44 + 


2x 43 


+ x 42 +x 41 +2x 40 + 2x 39 - 


K2x 38 


+ 2x 37 - 


x 36 4 


2v ! ^ • 2 v M • 2 v :< • v :| 


f2x 30 


+ x 29 + 


2x 2S 


+ 2x 21 +2x 26 + 2x 25 +x 24 


+ x 23 


+ x 22 + 


2x 21 


+ 2x 20 +x ls +x l6 +x l5 + 


x l4 + 


x 13 + 



2x 12 +x 11 +2x 10 + 2x 9 + 2/ + l. 



Notice that h = (m — 1 )/2. Hence, the parameters of this code agree with those of the code 
in Corollarv \4J8\ 
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4.6. Cyclic codes from the APN function x 3 . In this subsection we consider the code Cs 
defined by the APN function f(x) = x 3 over GF(r), where p > 3. We present the results 
without providing proofs as this case is simple. 

Lemma 4.43. Let s°° be the sequence ofQ, where fix) = x 3 and p > 3. Then the linear 
span L s of s°° is equal to 3m + N p (m) and the minimal polynomial M s (x) of s°° is given by 

(53) M. s (x) = (x - l) N " (m) m a -i (x)m a - 2 (x)m a - 3 (x) 

where m a j(x) is the minimal polynomial ofa J over GF(<7). 

The following theorem provides information on the code Q and its dual. 

Theorem 4.44. The code C s defined by the sequence of Lemma \4.43\ has parameters [n, n — 
3m — f$p(m),d] and generator polynomialM s (x) of (1531), where 4 < d < 8. When N p (m) = 
l,5<d<6. 

Example 4.45. Let (m,q) = (2,5) and abea generator of G¥{q m )* with a 2 +4a + 2 = 0. 
Then generator polynomial of the code Cs is 

M s (x) = x 7 + 3x 6 + 4x 5 + 4x 4 + 2x 3 + 4x 2 + x + 1 

and Cs is a [24, 17,5] cyclic code over GF(5). The upper bound on the minimum weight 
of any linear code of length 24 and dimension 17 over GF(5) is 6. The record linear code 
with parameters [24, 17,6] reported in the database maintained by Markus Grassl is not 
cyclic. 

Example 4.46. Let (m,q) = (3,5) and abea generator of G¥{q m )* with a 3 + 3a + 3 = 0. 
Then generator polynomial of the code Cs is 

M s (x) = x 1 + x 9 + x 5 + 3x 4 + 4x 3 + x + 4 

and Cs is a [124, 1 14, 5] cyclic code over GF(5). The upper bound on the minimum weight 
of any linear code of length 125 and dimension 114 over GF(5) is 6. The record linear 
code with parameters [124, 1 14,6] reported in the database maintained by Markus Grassl 
is not cyclic. 

4.7. Open problems regarding the nonbinary cyclic codes from APN and planar 
dunctions. In previous subsections of Section |4] some nonbinary cyclic codes from APN 
and planar functions were studied. It would be nice if the following open problems could 
be solved. 

Open Problem 4.47. Determine the dimension and the generator polynomial of the code 
Cs defined by the APN function f(x) = x' 3 ~ 3 V 2 over GF(3). Develop tight lower bounds 
on the minimum weight of this code. 

The following examples demonstrate that the code described in Open Problem 14.471 
looks promising. 

Example 4.48. Let (m, q) = (3,3) and abea generator ofG¥{q m )* with a? + 2a+ 1 = 0. 
77ie« generator polynomial of the code Cs is 

M s (x) = x 6 + 2x 5 + 2x 4 +x 3 +x 2 + 2x + 2 

and Cs is a [26, 20, 4] cyclic code over GF(3), and is an optimal linear code. 
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Example 4.49. Let (m,q) = (4,3) and a be a generator of GF(q m )* with oc 4 + 2oc 3 +2 = 0. 
Then generator polynomial of the code Cs is 

U s (x) =x n +2x 8 + 2x 6 + 2x 5 + 2x 4 + x 3 + 2x 2 +x + 2 

and C s is a [80,69,5] cyclic code over GF(3). The upper bound on the minimum weight 
of any linear code of length 80 and dimension 69 over GF(3) is 6. The record linear code 
with parameters [80,69,6] reported in the database maintained by Markus Grassl is not 
cyclic. 

Open Problem 4.50. Determine the dimension and the generator polynomial of the code 
C s defined by the inverse APN function f(x) = x q ~ 2 over GF(q'), where q is odd. Develop 
tight lower bounds on the minimum weight of this code. 

Regarding the cyclic code defined by the inverse APN function, the case for q = 2 was 
settled in Section |3~TI The case q being odd is more complicated. The code is interesting 
in the binary case. 

Open Problem 4.51. Determine the dimension and the generator polynomial of the code 
C s defined by the APN function f{x) = x' 5 + 1 )/ 2 over GF(5'"), where gcd(2m,/z) = 1. De- 
velop tight lower bounds on the minimum weight of this code. 

Open Problem 4.52. Determine the dimension and the generator polynomial of the ternary 
code Cs defined by the APN function f(x) = x e over GF(3'"), where 

( 3 (m+l)/2_i 

I - — J V m = 3 (mod 4) 

e ~ \ 3(m+l)/2_! 3 m_! . . 

[ - — 2 +^r^ ifm=\ (mod 4). 

Develop tight lower bounds on the minimum weight of this code. 

Open Problem 4.53. Determine the dimension and the generator polynomial of the ternary 
code C s defined by the APN function f(x) = x e over GF(3 m ), where 

( S^=l ifm = 3 (mod 4) 

6 -\ 3^1 + 3^1 ifm = l (mod4) . 

Develop tight lower bounds on the minimum weight of this code. 

Open Problem 4.54. Determine the dimension and the generator polynomial of the ternary 
code C s defined by the APN function f(x) = x e over GF(3 m ), where 

e= / 3 (m+l)/4_^ ( 3 ('»+D/2 +1 ^ m = 3 ( mod4 ). 

Develop tight lower bounds on the minimum weight of this code. 

5. A RELATED CONSTRUCTION OF CYCLIC CODES FROM HIGHLY NONLINEAR 

FUNCTIONS 

Given any nonlinear function f(x) on GF(r), we define its differential sequence s°° by 
(54) ^ = Tr(/(a' + l)-/(a ! ')) 

for all i > 0, where a is a generator of GF(r)* and Tr(x) denotes the trace function from 
GF(r) to GF(g). We use Q to denote the cyclic code defined by the sequence 
Polynomials over GF(r) of the form 

•j 
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are called Dembowski-Ostrom polynomials, where a,j e GF(r). If /(*) is a Dembowski- 
Ostrom planar function, then u(x) = f(x + 1) — f(x) is an affine permutation of GF(r). In 
this case, one can prove that the code Cs has generator polynomial (jc— l) 5 ?n a -i(x) and 
parameters [n,n — m — 8,d], where 5 € {0, 1 } and 

d = 3 if 5 = 1, 
= 2 if 8 = 0, 

The code Cs is optimal in this case. 

When f(x) — x h is a monomial over GF(r), the relation between codes Q and Cs must 
be one of the following: 

• The generator polynomial of Cs is equal to m a -i, (x) times that of Cs and the di- 
mension of Cs is equal to that of Q minus m. Hence, C s is a subcode of Cs- 

• The generator polynomial of Cs is equal to m a -i, (x) times that of C s and the di- 
mension of Q is equal to that of C s minus m. Hence, Q is a subcode of Cs. 

All of the APN and planar functions could be plugged into this related construction 
above and the codes Cs are extremely good (many are optimal and almost optimal). The- 
orems about the codes C s developed in previous sections can be modified into theorems 
about the codes Q, As an example, we will do this for the Welch APN function below. 
The rest of the modifications is left to the reader. 

Lemma 5.1. Let m~2t+l > 7. Let r be the sequence of ( I54D , where f(x) = x 2 ' +3 . Then 
the linear span hs of s°° is equal to 4ra + 1 and the minimal polynomial Mf(x) of s°° is 
given by 

(55) Mjf(x) = (x - l)m a -i (x)m a -3 (x)ra a _ (2 r +1) (x)m a _ (2 , +2) (x) 

where m a -j (x) is the minimal polynomial ofar 1 over GF(2). 

Proof. The proof of Lemma [3. 101 can be slightly modified into a proof of this lemma. The 
details are left to the reader. □ 

The following theorem provides information on Cs- 

Theorem 5.2. Let m > 7 be odd. The binary code Cs defined by the sequence of Lemma 
\5.1\ has parameters [2 m — 1,2'" — 2 — 4m, d] and generator polynomial Mj(i) of ( |55| ), where 
d>6. 

Proof. The proof of Theorem 13. 11 l ean be slightly modified into a proof of this theorem. 
The details are left to the reader. □ 

Example 5.3. Let m = 3 and a be a generator o/GF(2 m )* with a 3 + a + 1 = 0. Then Cs 
is a [7,6,2] optimal binary cyclic code with generator polynomial x+ 1. 

Example 5.4. Let m = 5 and a be a generator o/GF(2 m )* with a 5 + a 2 + 1 = 0. Then Cs 
is a [31,20,6] optimal binary cyclic code with generator polynomial x li +x 9 + x 8 +x 7 + 
x 2 +l. 

Example 5.5. Let m = l and a be a generator o/GF(2™)* with a 1 + a + 1 = 0. Then Cs 
is a [127,98,8] binary cyclic code with generator polynomial 

Ms(x) = x 31 +x i6 +x 35 +x M +x 33 +x 2S +x 26 +x 24 + 

* 22 +x 21 +* n +x 13 +x 9 +* 8 +* 7 +* 5 +* 4 +l. 

This code is not an optimal linear code, but may be the best binary cyclic code of length 
127 and dimension 98. 
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6. Concluding remarks and summary 

In this paper, we studied the codes derived from a number of highly nonlinear functions 
(including planar functions and almost perfect nonlinear functions). Many of these codes 
obtained from these functions are optimal or almost optimal. The dimension of some of 
the codes is flexible. We determined the minimum weight for some classes of cyclic codes, 
and developed tight lower bounds for some other classes of cyclic codes. The main results 
of this paper showed that the two approaches of constructing cyclic codes with planar and 
APN functions are quite promising. While it is rare to see optimal cyclic codes constructed 
with tools in algebraic geometry and algebraic function fields, the simple constructions of 
cyclic codes with monomials and trinomials over GF(r) employed in this paper are very 
impressive in the sense that it has produced many optimal and almost optimal cyclic codes. 

Binary sequences defined by the inverse APN function and the first Niho APN function 
have large linear span. The sequences defined by the Kasami APN function have also large 
linear span when h is close to m/4. These sequences have also reasonable autocorrelation 
property. They may be employed in certain stream ciphers as keystreams. For example, the 
sequence defined by the inverse APN function is used in the stream cipher in ll30l . So the 
contribution of this paper in cryptography is the computation of the linear spans of these 
sequences. 
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